Editing Security (section)

==How security relates to consumer rights==
Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it. {{Citation needed|reason=needs verifiability}}

===Poor security principals harm the consumer===
A large number of security incidents are caused because the producer of a product has a general misunderstanding of what security is and how to produce secure products. In addition a misunderstanding of the purpose of security can induce companies to take actions capable of harming consumer rights.

====Security through obscurity====
[[Security through obscurity|Obscuring]], or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities{{Citation needed|reason=needs verifiability}} it can never stop them{{Citation needed|reason=Who?}}, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair|right to repair]]. {{Citation needed|reason=needs verifiability}}

====Security through authorization====
Authorization is the process of confirming that a user is who they say they are. Authorization processes are extremely important to the functioning of the internet but risk becoming a security vulnerability and threat to consumer rights if used improperly. Authorization features can be used by companies to lock out features when the user's subscription expires, in this case the purpose of authorization is lost because the user need not confirm who they are, just that they have a valid subscription. These sorts of lock-outs are significant in that the product's physical features still work but the company is intentionally preventing the user from accessing them because their internet-based subscription has ended. 

Authorization for the sake of company product control harms the consumer's [[right to own]] their purchase and also can introduce new attack vectors for malicious actors. Attack vectors may be introduced within the product itself: malicious actors can't remotely hack a fridge without an internet connection but they might be able to hack a smart fridge that has the user login via the internet. Attack vectors may be introduced on the user's information as the company now needs to store authorization information (password hashes, usernames, emails, god forbid in clear text) and may do so insecurely opening themselves to attack.

===How to avoid losing rights in the name of "security"===

#Avoid using physical and software products that needlessly require connection to the internet. Your fridge does not need to be "smart". Choosing to use a smart appliance opens the door for companies to take away your rights as well as open you to security vulnerabilities.
#Avoid using physical products that require a proprietary app to use. While the product itself may not connect directly to the internet, your internet device now serves as a bridge to it. This opens the door for companies to take away your rights via the app. In addition the app itself may have security vulnerabilities of its own.
#Avoid using physical products that need a subscription to use, a normal treadmill won't brick itself if the company goes out of business, or decides to [[Peloton Removes Just Run Feature|eliminate a subscription free feature]] in the name of safety or security.
#Avoid using closed-source products if equivalent open-source products exist. Open source products are not necessarily more secure, but they are far less likely to violate a consumer's rights simply because the consumer has the ability to change the product as they wish.